Nix modules in TypeScript, typed by your own configurations.

From option graph to plain Nix

1. Probe the option graph

   Works today

   src/probe.nix walks a configuration's options with builtins only and prints the tree as JSON. It reads the module system's type metadata, such as nested types, enum values and submodule options, and never parses descriptions. srv-2 takes 11 seconds.

   Shell

   nix eval --impure --json .#nixosConfigurations.srv-2.options \
     --apply 'import ./src/probe.nix { class = "nixos"; }'

   srv-2.json One option, as the probe prints it

   {
     "PermitRootLogin": {
       "id": "/nix/store/fjr02205wq70r3vghhfbfzv5g97nr4ya-source/nixos/modules/services/networking/ssh/sshd.nix:554:15#PermitRootLogin",
       "description": "Whether the root user can login using ssh.\n",
       "type": {
         "description": "null or one of \"yes\", \"without-password\", \"prohibit-password\", \"forced-commands-only\", \"no\"",
         "name": "nullOr",
         "nested": {
           "elemType": {
             "description": "one of \"yes\", \"without-password\", \"prohibit-password\", \"forced-commands-only\", \"no\"",
             "name": "enum",
             "values": ["yes", "without-password", "prohibit-password", "forced-commands-only", "no"]
           }
         }
       },
       "visible": true
     }
   }

2. Generate types

   Works today

   src/Typegen.ts turns the tree into interfaces that describe evaluated values. Groups and submodules become interfaces named after their first option path, and identical ones are shared. An option's description becomes its JSDoc, so the editor shows it on hover. typeflake types nixosConfigurations.srv-2 runs the probe and the generator and writes the result into .typeflake/.

   options.ts An excerpt of what the generator wrote

   export type ServicesOpensshSettingsPermitRootLoginValue = "yes" | "without-password" | "prohibit-password" | "forced-commands-only" | "no" | null
   
   export interface ServicesOpensshSettings {
     /**
      * Specifies whether password authentication is allowed.
      */
     readonly PasswordAuthentication: boolean | null
     /**
      * Whether the root user can login using ssh.
      */
     readonly PermitRootLogin: ServicesOpensshSettingsPermitRootLoginValue
     /**
      * Whether to enable printing /etc/motd when a user logs in interactively.
      */
     readonly PrintMotd: boolean | null
   }

3. Write a module

   Works today

   A module is a *.nix.ts file like the one at the top. Generated declarations augment a Register interface, so NixOS.module(…) is typed without annotations. The first port typechecks against srv-2's types in 0.77 seconds, and four mistakes injected into it all fail.

4. Render it to Nix

   Works today

   typeflake render writes each module's .nix file next to it, and --check fails when one is out of date. Your flake.nix imports the result like any other module. Delete the .ts files and the repository still builds.

5. Check the port

   Done for app-stores

   A port must not change what any host builds. For app-stores, each host swapped the module once for a copy of the original and once for the rendered port, and both printed the same drvPath, on srv-2 and on m1.

   Shell

   nix eval --raw .#nixosConfigurations.srv-2.config.system.build.toplevel.drvPath